Static task
static1
Behavioral task
behavioral1
Sample
NEAS.013514f636520b9e062228be96cd9e70_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.013514f636520b9e062228be96cd9e70_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.013514f636520b9e062228be96cd9e70_JC.exe
-
Size
37KB
-
MD5
013514f636520b9e062228be96cd9e70
-
SHA1
2872e94645b4340e48bd8021bcd960dc2d6a70ae
-
SHA256
2b29561608db8a9b9b08c56e7d70c7da7b4af5f2612d36f6ebcd74808c0fee38
-
SHA512
73cbea8f02ea28773f9192a08f69093c308579e2f9567c0fdd775e8bfd043586c519d95577536e26f4beef585fbd51f147f3011fe661e68aa633ec4b5617a8ae
-
SSDEEP
768:2N+9pmt3bbED+qU+oYNx0NnInQT4aATv0axLOQ+fjfx:2c9UtrdqUhY8NInQkTHxLN+fT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.013514f636520b9e062228be96cd9e70_JC.exe
Files
-
NEAS.013514f636520b9e062228be96cd9e70_JC.exe.exe windows:6 windows x86
7ac8ee21bedd38942dbbf8efb83537e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessW
GetCurrentProcess
GetSystemDirectoryW
FormatMessageW
GetLastError
HeapSetInformation
CloseHandle
LocalFree
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
user32
MessageBoxW
msvcrt
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_vsnwprintf
_cexit
__p__fmode
memset
ntdll
NtQueryInformationProcess
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gsfavlz Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE